What is the CVSS score of EUVD-2025-209077?

EUVD-2025-209077 has a CVSS 3.1 base score of 2.6 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Aftermarket Dpc are affected by EUVD-2025-209077?

CVE-2025-55277 is a low-severity vulnerability in HCL Aftermarket DPC (CVSS 2.6). The limited severity suggests constrained impact, typically requiring specific conditions or local access for…

How to fix or mitigate EUVD-2025-209077?

During next maintenance window: Apply vendor patches when convenient. Monitor vendor channels for updates.

Aftermarket Dpc EUVD-2025-209077

| CVE-2025-55277 LOW

Use of Unmaintained Third Party Components (CWE-1104)

2026-03-26 HCL

GHSA-34h3-v5r4-2979

Information Disclosure Aftermarket Dpc

2.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

2.6 LOW

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 13:15 euvd

EUVD-2025-209077

Analysis Generated

Mar 26, 2026 - 13:15 vuln.today

CVE Published

Mar 26, 2026 - 12:45 nvd

LOW 2.6

DescriptionCVE.org

HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability using which an attacker may make use of the exploits available across the internet and craft attacks against the application.

AnalysisAI

HCL Aftermarket DPC version 1.0.0 contains outdated or vulnerable dependencies (CWE-1104) that expose the application to known public exploits, enabling authenticated attackers with low privileges to obtain limited information disclosure. The vulnerability requires user interaction and carries a low CVSS score of 2.6, but represents a supply chain risk where publicly available exploits targeting the embedded libraries could be weaponized against deployments. No public exploit code has been independently confirmed, and CISA has not flagged this for active exploitation.

Technical ContextAI

This vulnerability falls under CWE-1104 (Use of Unmaintained Third Party Components), a component supply chain weakness where HCL Aftermarket DPC incorporates outdated or unpatched libraries with known vulnerabilities. The CPE designation (cpe:2.3:a:hcl:aftermarket_dpc:*:*:*:*:*:*:*:*) indicates the entire Aftermarket DPC product line is potentially affected. Rather than a direct code flaw in the application itself, the risk stems from reliance on third-party components that have publicly disclosed vulnerabilities available in common exploit databases and repositories. Attackers can identify these components through fingerprinting and deploy known-working attack code without discovering novel vulnerabilities.

RemediationAI

Contact HCL support via the vendor security advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0129793 to obtain a patched release and detailed component inventory. If a patched version is available, upgrade Aftermarket DPC immediately. Pending vendor remediation, implement network-level controls: restrict access to Aftermarket DPC to authenticated internal users only, enforce TLS 1.2+ for all connections, and disable unnecessary features. Conduct a software composition analysis (SCA) scan of the deployment to identify specific vulnerable third-party libraries and cross-reference them against public exploit databases. If the vendor has not released a patch, request explicit timeline for remediation and interim compensating controls such as WAF rules or reverse proxy hardening to block known exploit signatures.